Disallow dangerous functions

disable_functions = phpinfo, system, mail, exec  

Try to limit resources

Maximum execution time of each script, in seconds

max_execution_time = 30  

Maximum amount of time each script may spend parsing request data

max_input_time = 60  

Maximum amount of memory a script may consume (8MB)

memory_limit = 8M  

Maximum size of POST data that PHP will accept.

post_max_size = 8M  

Whether to allow HTTP file uploads.

file_uploads = Off  

Maximum allowed size for uploaded files.

upload_max_filesize = 2M  

Do not expose PHP error messages to external users

display_errors = Off  

Turn on safe mode

safe_mode = On  

Only allow access to executables in isolated directory

safe_mode_exec_dir = php-required-executables-path  

Limit external access to PHP environment

safe_mode_allowed_envvars = PHP  

Restrict PHP information leakage

expose_php = Off  

Log all errors

log_errors = On  

Do not register globals for input data

register_globals = Off  

Minimize allowable PHP post size

post_max_size = 1K  

Ensure PHP redirects appropriately

cgi.force_redirect = 0  

Disallow uploading unless necessary

file_uploads = Off  

Enable SQL safe mode

sql.safe_mode = On  

Avoid Opening remote files

allow_url_fopen = Off